Coin Processing Audit February 2, 2016

Transcription

1 Coin Processing Audit February 2, 2016

2 The Office of the City Auditor conducted this project in accordance with the International Standards for the Professional Practice of Internal Auditing Office of the City Auditor

3 Coin Processing Audit Table of Contents 1. Introduction Background Audit Objective Audit Scope and Methodology Observations and Recommendations Coin Processing - Effectiveness Coin Processing Operations Cash Handling Procedures Coin Processing Operations Safety and Security Coin Processing Monitoring Controls Coin Processing - Efficiency Coin Processing - Economy Conclusions Office of the City Auditor

4 This page intentionally left blank Office of the City Auditor

5 Coin Processing Audit 1. Introduction The Office of the City Auditor (OCA) included a value-for-money audit of the City s Coin Processing Operations in its 2015 Annual Work Plan. Value-for-money audits determine whether a department, service, or program operates efficiently, effectively, and economically and whether risks are appropriately mitigated. Results from these audits are used both by the Administration and by City Council to improve the manner in which each program delivers its services. To protect the safety and security of the Coin Processing Operations, we communicated sensitive findings and information that could potentially impact the safety and/or security of Coin Processing Operations to management and excluded them from this report. 2. Background Coin Processing Operations (CPO) is an area in Treasury Management, a section within the Financial Services Branch of the Financial Services and Utilities Department. CPO is responsible for sorting, counting, balancing and depositing all cash received from the following business areas within the City of Edmonton (the City): Edmonton Transit (buses, DATS, and LRT), Traffic Operations (parking meters and pay machines), and Community and Recreational Facilities (locker rentals). In addition, CPO employees sort and securely destroy cash-like products (tickets, transfers, and passes) exchanged for services. Also, CPO manages the inventory of coins and bills for LRT ticket vending machines, and ensures a sufficient float of coins is available for the LRT system. Employees in three other groups in the City perform control functions for CPO. They are: 1. Cash Consulting: They are a group in Treasury Management that provide assistance in implementing new procedures, investigate irregularities, perform periodic integrity tests, perform periodic physical spot checks, and monitor live or recorded images of CPO. 2. Cash Control: They are a group in Treasury Management that reconcile money deposited by CPO employees to the bank statements, enter deposited amounts into the cash system, and allocate the deposit amount to the corresponding department s account. 3. Corporate Security: They periodically conduct Site Security Audits, monitor live or recorded images, provide findings and specifics of each alarm incident reported, Office of the City Auditor Page 1

6 investigate on-site incidents, and provide security advice as requested by CPO employees and management. CPO employees processed an average of 2.8 million coins and bills per month in Table 1 shows the number of coins and bills processed by CPO per business area from 2010 to Table 1: Number of Coins and Bills Processed (in 000 s) Number of Coins Edmonton Transit 34,902 36,901 27,615 27,690 27,028 24,995 Traffic Operations 8,067 7,928 7,664 7,424 7,345 6,817 Community and Recreational Facilities ,058 Total Coins Processed (#) 43,585 45,778 36,188 35,961 35,232 32,870 Number of Bills Edmonton Transit Traffic Operations Community and Recreational Facilities Total Bills Processed (#) Total Coins and Bills Processed (#) 44,230 46,476 36,930 36,776 36,031 33, Audit Objective The objective of this audit was to determine if the City s coin processing operations are operated effectively, efficiently, and economically. 4. Audit Scope and Methodology The scope of this audit included documentation, processes, and controls that related to coin processing operations at the time we completed the field work for this audit, from September until November We used the following methods to gather evidence to conclude on the above objective: Reviewing documentation; Discussions with management and supervisory employees; Analysis of data; Testing samples relating to compliance with CPO procedures; and Benchmarking with other Canadian municipalities. Office of the City Auditor Page 2

7 5. Observations and Recommendations 5.1. Coin Processing - Effectiveness To assess the effectiveness of the City s coin processing operations, we: Reviewed the CPO Cash Handling Procedures (the Procedures) and tested compliance with the key controls in the document; Reviewed CPO safety and security equipment; and Tested monitoring and follow-up practices for CPO. Overall, we found that CPO is effective in mitigating the risk of mismanagement of City cash. We did not identify any critical control deficiencies or find any major threats to the CPO s security. We also did not observe any incident where City s assets were being misappropriated. We did identify the potential to reduce some of the remaining risk in the areas discussed below. A formal risk assessment would need to be conducted to determine if additional controls are necessary or if the risk is acceptable. When assessing the risk, management will need to consider both the financial risk and the impact of additional controls on CPO. (See Recommendation 1) Coin Processing Operations Cash Handling Procedures The Procedures is a set of money handling procedures specific to CPO. Treasury Management follows a formal process to amend the Procedures when a change is requested by the Director of Treasury Management, Manager of Cash Operations, CPO employees, or the Cash Consulting Unit. The need for an amendment to the Procedures may be driven by a change in CPO s business process, technology, or control improvement. Although Treasury Management has an effective process for reviewing, amending, and updating the Procedures, we found risks associated with the following areas: Police information check requirements Police information checks allow the City to determine if an individual has any criminal charges or convictions that could indicate an unacceptable risk in performing the duties of their position. The Procedures require all CPO employees to obtain a police information check prior to the start of their employment. In addition, the Procedures indicate that updated checks should be done every three years. We reviewed the police information check records for all applicable employees who worked for CPO in 2014 and 2015 and found that none had obtained an updated check. CPO management should assess the risk associated with non-compliance to this procedure as well as the practicality of the requirement and update the Procedures to reflect the assessment, if required. Office of the City Auditor Page 3

8 Daily reconciliation verification As part of the daily cash balancing process, the Procedures require CPO employees to complete a Daily Reconciliation of Cash Processed Report (the Daily Report). This report is used to summarize cash processed, shipped, and deposited in the bank for the day. The daily cash balancing process includes a comparison of the Daily Report to the memorandum of deposit. This process is used to ensure money deposited in the bank agreed to what was processed and shipped. We randomly selected 20 days and reviewed the Daily Reports for those days. We found that on 3 of the Daily Reports the summary of the cash processed, shipped, and deposited in the bank did not agree. Upon further review of supporting documentation we did not find any instance where the actual amount of money deposited in the bank was incorrect. The amounts had been incorrectly recorded in the Daily Reports. We found that in the Daily Reports for 2 of the 3 days with errors, the verifier was the same as the preparer. We then checked the rest of our 20 samples and found that the verifiers are the same as the preparers on 55 percent of the Daily Reports and the Daily Reports did not have a verifier 15 percent of the time. When the figures recorded on the Daily Reports do not agree, it may be an indicator that there is an error in the reports used to create them. Undetected errors in the Daily Reports may potentially result in errors in daily cash being deposited. However, these potential errors can be caught if the Daily Reports were verified by a person who is different from the preparer. CPO management should assess the risk associated with unreconciled Daily Reports and update the Procedures to reflect the assessment, if required. Emergency procedures In the Procedures, Treasury Management included a section on dealing with power failure, fire, and robbery. An Emergency Procedures Manual (the Manual) was created to provide CPO employees with instructions on how to respond to emergency situations. We found that there are discrepancies between the Procedures and the Manual. For example: The Procedures state that the Director must be immediately informed in the case of power outage or fire. However this instruction is not included in the Manual. In the event of a power outage, the Procedures discuss that work can continue with enough available light. However, the Manual instructs to stop regular office duties. There is no formal process in place for developing, reviewing and approving the CPO emergency procedures and ensuring the consistency between the Manual and the Procedures. When there are discrepancies between the Manual and the Procedures, CPO employees may not know which set of the emergency procedures to follow. This may lead to additional time for the CPO employees to make decisions when responding to an emergency situation. CPO management should assess the risk associated with Office of the City Auditor Page 4

9 current emergency procedures, and update the Procedures to reflect the assessment, if required. Employee acknowledgement of procedures The Procedures requires all permanent and temporary employees occupying positions mentioned in the Procedures to read and acknowledge their understanding and acceptance of the procedures by signing a Coin Processing Operations Cash Handling Procedures Acknowledgement Form (the Acknowledgment Form). The Cash Consulting group also requires all CPO employees to read any amendments to the Procedures and re-sign the Acknowledgement Form. We reviewed the Acknowledgement Form sign offs for all employees who worked for CPO in 2014 and 2015 and found the following: 100 percent of the permanent employees signed the Acknowledgement Form. 26 percent of temporary employees signed the Acknowledgment Form. 17 percent of permanent and temporary employees who were required to sign an Acknowledgment Form for amendments had signed one. Without signing the Acknowledgement Form, there is a risk that employees might not have read and understood the Procedures and amendments to it. Without an understanding of the Procedures, there is a risk of inconsistencies in complying with it. Management also cannot assume someone has read the Procedures in the event of noncompliance. CPO management indicated that they have not required all temporary employees to sign off on the Acknowledgement Form because some only work for a very short period of time with very limited assigned duties. However, the Procedures were not updated to reflect this decision. CPO management should assess the risk associated with noncompliance to this sign off procedure, as well as assessing the operational efficiencies of having all employees sign off on the Procedures, and update the Procedures to reflect the assessment, if required. Conclusion The Procedures help safeguard CPO employees and City assets; as well they provide consistent procedures for coin processing. We did not find any critical control deficiencies with the Procedures, however we identified risks relating to police information check requirements, daily reconciliation verification, emergency procedures, and employee acknowledgement of the Procedures. CPO management should assess these risks and determine how best to address them. We have made a recommendation in this report to address the risks identified with the Procedures. (See Recommendation 1) Coin Processing Operations Safety and Security CPO has equipment in place to help ensure the safety and security of its employees and City assets. Office of the City Auditor Page 5

10 We found that overall the safety and security equipment is effective in meeting the needs of CPO. However, we found the following areas of risk that management should assess: Critical equipment list and maintenance status CPO safety and security equipment includes closed-circuit TV (CCTV) cameras, sensors, and panic buttons. The Facility Maintenance Services section of the Facility and Landscape Infrastructure Branch in the Integrated Infrastructure Services Department is responsible for the maintenance of the equipment. Maintenance includes inspecting and testing the equipment, as well as replacing the back-up batteries as required and ensuring the equipment operates appropriately. It is the responsibility of an area within another branch to perform the maintenance and testing of the safety and security equipment. However, CPO management should also be aware of all critical equipment and know if it is working as intended. We found that CPO management does not maintain a list of all critical equipment; as well they are not aware if all equipment is working as intended. Without maintaining a list of all critical equipment there is a risk that management may not know whether the equipment is operating as intended, which could lead to safety issues or loss of City assets. CPO management should assess the risk associated with management not being familiar with the critical safety and security equipment and determine if additional action is required. CCTV System CPO uses CCTV cameras for safety and security purposes. Cash Consultants and Corporate Security employees view live or recorded video footage to detect violations of the Procedures and detect any security incidents. The current camera placement adequately covers all critical areas. Although the current CCTV system meets CPO s operational needs, there are some risks associated with the effectiveness and efficiency of using it to monitor CPO. CPO management should assess the risk associated with the current CCTV system. Site Security Audit Recommendations follow up process Corporate Security performs Site Security Audits for the City s properties on a five to seven year cycle based on the nature of the property. These audits assess the security risks to the sites and employees working on site. Based on the audit result, Corporate Security makes recommendations for site owners to consider implementing. The last Site Security Audit for CPO was conducted in We found that CPO management does not have a formal process in place to track and document the implementation status of accepted Site Security Audit recommendations. Without tracking and documenting the status of these recommendations, there is a risk that they will not be addressed in a timely manner. Thus, it could expose CPO to security threats. CPO management should assess the risk associated with this lack of a formal process. Office of the City Auditor Page 6

11 Conclusion Safety and security equipment is in place to protect CPO employees and the City s assets. We did not identify any threats to the CPO s security; however, we identified risks associated with the lack of a critical safety and security equipment listing, the CCTV system, and the lack of a formal process to document the status of Corporate Security Site Security Audit recommendations. CPO management should assess these risks and determine how best to address them. We have made a recommendation in this report to address the risk identified with the CPO s safety and security. (See Recommendation 1) Coin Processing Monitoring Controls The Cash Consulting Unit monitors CPO employees for compliance with the Procedures through the following activities: Integrity tests: With the help of Corporate Security and the business areas, Cash Consultants trace marked money from the source to the destination to ensure CPO employees followed the Procedures and deposited the money they received adequately. Spot checks: Cash Consultants periodically perform surprise visits to check if the CPO employees comply with the Procedures. CCTV monitoring: Cash Consultants and Corporate Security employees review CCTV footage to monitor the CPO employees compliance to the Procedures. We did not find any issues with the processes or documentation for the integrity tests or the spot checks. However, we found the following risks with the CCTV monitoring activities: CCTV viewing process Cash Consultants and Corporate Security employees view the live or recorded CCTV footage to detect violations of the Procedures according to a schedule developed by the Cash Consultants. We found that Cash Consultants and Corporate Security staff are not consistently applying the CCTV viewing process. For example, Cash Consultants are required to sign off on their reviews and Corporate Security employees are not required to sign off. The current CCTV monitoring procedures do not establish a timeline for when CCTV footage should be reviewed and when an Incident Report should be completed. We found that CCTV footage reviews are not always completed in a timely manner. When assigned days are not being viewed in a consistent and timely manner, there is a risk that violation of the Procedures may not be detected. CPO Management should assess the risk associated with the lack of an established timeline for CCTV monitoring. Incident follow-up process When Cash Consultants or Corporate Security employees confirm an incident where there is a violation of the Procedures, they will document the incident in a CPO CCTV Office of the City Auditor Page 7

12 Incident Report (Incident Report). The Director of Treasury Management and the Manager of Cash Operations will follow up on the incident and document the outcome. We reviewed all 10 CCTV Incident Reports filed in 2014 to the end of October None of the 10 incidences were related to the misappropriation of cash. Examples of incidents reported include: the requirement to have a minimum of two employees present in the processing room, the requirement to have at least two employees present when counting bills, wearing pocketless coveralls in a proper manner (e.g., pockets securely sewn shut, removed, or fully zipped), employee attendance in the receiving area when the delivery chute window is open, not having money present in visitor s working area if not attended by an employee, etc. CPO does not have guidance on how soon discussion of Incident Reports should be completed. We found that the date when an Incident Report was received by the Director of Treasury Management was not documented. As well, although all incidents were discussed with employees, the date of the discussion was not recorded for three of the incidents. Therefore, it is difficult to determine if an incident was followed up within a reasonable time. Based on our professional judgement, we assess two weeks is an ideal time frame for a timely discussion of incidents. We found that discussions for five Incident Reports did not occur within two weeks. When incidents are not being dealt with in a reasonable time, violations of the Procedures may not be corrected in a timely manner. CPO Management should assess the risk related to not establishing guidance on timely discussion of incidents. Conclusion Monitoring activities are essential in helping identify violations of the Procedures. Incident follow-up procedures are important in improving the CPO employees compliance with the controls included in the Procedures. We did not identify any control deficiencies with CPO monitoring; however, we identified risks associated with the CCTV viewing process and incident follow-up process. CPO management should assess these risks and determine how best to address them. We have made a recommendation in this report to address the remaining risk issues identified associated with the CPO s monitoring controls. (See Recommendation 1) Recommendation 1 Additional Review of the Risks The OCA recommends that the Director of Treasury Management review the risks we have identified in the following areas and develop action plans to address them or document the rationale for accepting them: Cash handling procedures, Coin processing safety and security, and Coin processing monitoring control. Office of the City Auditor Page 8

13 Management Response and Action Plan Accepted Comments: Cash handling procedures Management is assessing the risks related to police information check requirements, daily report verification, emergency procedures, and employee acknowledgement of the Procedures and will determine appropriate amendments to the Procedures based on this assessment. Coin processing safety and security Management is currently reviewing the safety and security equipment to ensure that CPO employees are familiar with all critical equipment as well as the intended operation of this equipment. Management has identified that the CCTV cameras are adequate and their current placement covers all critical areas of the operation. Any potential future investment in improved camera technology will be assessed against the benefit derived in order to ensure the appropriate use of capital funds in a constrained environment. Management will continue to assess the need for upgraded technology and the timing of any upgrade to optimize the benefit of any investment. Management will assess the risk associated with the lack of formal process to document the status of Corporate Security Site Security Audit recommendations and develop a process that is sufficient to address the risks. Coin processing monitoring control Management will assess the risks associated with the CCTV viewing process and the incident follow up process and identify any process changes that are required to address the risks. This assessment will include an examination of the timeliness of both the viewing process and the incident follow up procedures. Planned Implementation Date: April 30, 2016 Responsible Parties: Manager Cash Operations 5.2. Coin Processing - Efficiency In order to assess the efficiency of CPO we analyzed the results of the following performance measures over the past five years: Value of bills and coins processed per full-time equivalent (FTE) Operating expenses per dollar processed We also attempted to assess CPO operational efficiency by analyzing the number of days it takes CPO employees to process and deposit the cash they received for a sample of 20 days. CPO management s goal is to process and deposit cash received within one business day. This is included in the Procedures. However, we found that the Office of the City Auditor Page 9

14 Operating Expenses per $ Processed EDMONTON appropriate data to calculate the results of this measure was not collected. (See Recommendation 2) Value of bills and coins processed per FTE Over the past 5 years the value of coins and bills processed per FTE has remained fairly consistent. It fluctuated slightly year over year with an overall increase of 1.7 percent from 2010 to See Figure 1. Figure 1: Value of Bills and Coins Processed per FTE ( ) 1 Operating expenses per dollar processed Over the past 5 years, operating costs per dollar processed has remained fairly consistent, as shown in Figure 2. Figure 2: Operating Expenses per Dollar Processed ( ) Numbers are not shown in the figure to protect sensitive financial information. Office of the City Auditor Page 10

15 Conclusion Our analysis of the value of bills and coins processed per FTE and operating expenses per dollar processed shows that CPO has maintained a consistent level of efficiency over the past five years. However, we were unable to calculate the result of the measure chosen by Treasury Management to assess efficiency. Without assessing the CPO s performance, management may be unable to determine whether the goal set in the Procedures is realistic and appropriate or if they should implement strategies to improve the efficiencies of their operations. Recommendation 2 Assessing performance measures The OCA recommends that the Director of Treasury Management develop and implement a formal process to track performance data and assess the efficiencies of CPO. Management Response and Action Plan Accepted Comments: Treasury Management is working to develop a monthly scorecard including Key Performance Indicators that the CPO will use to track its performance against identified goals. Key Performance Indicators will include measures of efficiency and deposit process time. Planned Implementation Date: April 30, 2016 Responsible Parties: Director, Treasury Management 5.3. Coin Processing - Economy To determine if CPO is economical we inquired with management if they have performed an in-house versus outsourcing analysis. We also compared the City s CPO with information received from three other municipalities. We found that CPO management has recently initiated an in-house versus outsourcing analysis. We also found that the services CPO provides are economical compared to other municipalities. In-house versus outsourcing analysis Conducting an in-house versus outsourcing analysis is essential to assess whether the services the CPO provides are economical for the City or if it would be more economical for them to be provided by an external provider. CPO management has not previously performed an analysis. However, they are moving forward and obtaining additional information for an in-house versus outsourcing analysis. Office of the City Auditor Page 11

16 Comparison to other cities To assess whether the City s CPO is cost effective compared to other municipalities, we sent a questionnaire to 11 Canadian municipalities regarding their coin processing operations. We received 3 completed responses. Based on the comparison, the City s CPO is providing economical services. The three municipalities we received completed responses from all operate their coin processing functions in-house. Edmonton s CPO processed the highest value of bills and coins from 2010 to 2012, and processed the second highest value of bills and coins in 2013 and 2014, as shown in Figure 3. Figure 3: Value of Bills and Coins Processed ( ) 2 Edmonton s CPO has the lowest operating expenses per dollar processed in 2010, 2012, 2013 and 2014 and the second lowest in 2011, as shown in Figure 4. 2 Names of the cities are not shown in the figures to protect the confidentiality of participating municipalities. Numbers are not shown in the figure to protect sensitive financial information. Office of the City Auditor Page 12

17 Figure 4: Operating Expenses per Dollar Processed ( ) 2 6. Conclusions The objective of this audit was to determine if the City s coin processing operations are operated effectively, efficiently, and economically. Overall, we found that the City s coin processing operations are effective in mitigating the risk of mismanagement of City cash. We did not identify any critical control deficiencies or find any major threats to CPO security. We also did not observe any incident where City s assets were being misappropriated. However, we did identify some remaining risks to the effectiveness of CPO. We made one recommendation for management to review these risks to determine if additional controls are required or if the risk is acceptable. We assessed that CPO has maintained a consistent level of efficiency over the past five years. A goal for efficiency was set in the Procedures; however, CPO management is not collecting the appropriate data to measure their performance against the goal. We made one recommendation to develop and implement a formal performance measures process. Our comparison with other municipalities showed that the services CPO provides are economical compared to other municipalities. We thank the management and staff of Treasury Management Section of the Financial Services Branch and staff of the Corporate Security Branch for their cooperation and assistance during this audit. Office of the City Auditor Page 13